Posted by Robert Lazarski on Nov 06 Severity: important Affected versions: - Apache Axis2/Java before 2.0.2 Description: Improper Restriction of XML External Entity Reference vulnerability in Apache Axis2/Java. When a client built an AxisService from a WSDL URL, through ServiceClient or AxisService.createClientSideAxisService, wsdl4j import resolution was enabled and the documents named by wsdl:import and xsd:import were parsed by wsdl4j's own XML parser, which...
CVE-2026-120761: Apache Axis2/Java: XML External Entity (XXE) injection via imported WSDL/XSD documents
About this summary. This is a short excerpt from the description that oss-security published with its article. Cyber Security News did not report or verify the underlying story. Read the original: https://seclists.org/oss-sec/2026/q4/556
Source attribution: headline and facts are from oss-security (seclists.org). Summary method: excerpt of the source description. See our source attribution policy.
Related coverage
CVE-2026-123779: Apache Axis2/Java: exposeServiceMetadata not enforced on all metadata routes
Posted by Robert Lazarski on Nov 06 Severity: low Affected versions: - Apache Axis2/Java before 2.0.2 - Apache Axis2/Java before 2.0.2 Description: Direct Request…
CVE-2026-120832: Apache Axis2/Java: SSRF via WSDL/XSD schema import resolution
Posted by Robert Lazarski on Nov 06 Severity: moderate Affected versions: - Apache Axis2/Java before 2.0.2 Description: Server-Side Request Forgery (SSRF) vulnerability…
CVE-2026-120367: Apache Axis2/Java: unbounded JSON request body buffering
Posted by Robert Lazarski on Nov 06 Severity: low Affected versions: - Apache Axis2/Java before 2.0.2 Description: Allocation of Resources Without Limits or Throttling…
CVE-2026-123770: Apache Axis2/Java: Unbounded multipart and form-encoded request bodies
Posted by Robert Lazarski on Nov 06 Severity: low Affected versions: - Apache Axis2/Java before 2.0.2 Description: Allocation of Resources Without Limits or Throttling…
CVE-2026-123766: Apache Axis2/Java: Cross-site scripting in the OpenAPI module's Swagger UI page
Posted by Robert Lazarski on Nov 06 Severity: moderate Affected versions: - Apache Axis2/Java 2.0.1 before 2.0.2 Description: Improper Neutralization of Input During Web…
CVE-2026-123753: Apache Axis2/Java: SSRF via WS-Addressing ReplyTo and FaultTo endpoints
Posted by Robert Lazarski on Nov 06 Severity: important Affected versions: - Apache Axis2/Java before 2.0.2 Description: Server-Side Request Forgery (SSRF) vulnerability…